[WIP] Fix AI Moderator chatgpt.com connection issue due to firewall

[Copilot]

Thanks for asking me to work on this. I will get started on it and keep this PR's description up to date as I form a plan and make progress.

---

This section details on the original issue you should resolve

<issue_title>[aw-failures] AI Moderator (Codex): chatgpt.com blocked by firewall</issue_title>
<issue_description>### Problem Statement

The AI Moderator workflow running with the Codex engine (v0.121.0) is attempting to make egress connections to chatgpt.com:443, which is blocked by the workflow's network firewall. This causes the agent job to fail silently — the agent starts (1.4 min runtime, 1 MB of stdio logged) but produces 0 parsed turns and the job concludes as failure.

This is a separate failure mode from the OpenAI 401 Unauthorized issue tracked in #27404.

Affected Workflow & Runs

• Workflow: AI Moderator
• Engine: Codex v0.121.0 (model: auto)
• Failed run: §24681803841
• Trigger: issues event (actor: verkyyi), 2026-04-20T17:28 UTC
• Parent investigation: [aw-failures] [aw] Failure Investigation Report — 2026-04-20 13:09–19:09 UTC #27410

Firewall Evidence

Domain	Allowed	Blocked
api.openai.com:443	13	0
chatgpt.com:443	0	1
github.com:443	2	0

OpenAI credentials were functional (13 successful API calls). The failure is a network-level block, not an auth issue.

Probable Root Cause

Codex v0.121.0 or a tool it invokes is making an outbound call to chatgpt.com during execution. Possible causes:

1. A browsing/search tool in the Codex agent's toolbox is calling chatgpt.com for a web lookup
2. The Codex binary itself contacts chatgpt.com for telemetry, licensing, or a capability check
3. A prompt or tool call in the workflow inadvertently triggers a chatgpt.com request

Proposed Remediation

1. Investigate: Read /tmp/gh-aw/aw-mcp/logs/run-24681803841/agent-stdio.log (1 MB) to find which tool or subprocess attempted the chatgpt.com call
2. If intentional: Add chatgpt.com:443 to the AI Moderator workflow's firewall allowlist
3. If unintentional: Fix the agent prompt or tool configuration to prevent the call, or upgrade/downgrade Codex to avoid the behavior

Success Criteria

• AI Moderator (Codex) completes without firewall blocks when triggered by the issues event
• Either chatgpt.com:443 is added to the allowlist and the call is confirmed intentional, or the call is eliminated from the agent's execution path

Generated by [aw] Failure Investigator (6h) · ● 285.2K · ◷

• expires on Apr 27, 2026, 7:18 PM UTC

Comments on the Issue (you are @copilot in this section)